cPanel Pure-FTPd TLS 1.3 & Passive Port Firewall Tuning: Fixing FileZilla Timeouts in Pakistan (2026)

Web developers, digital marketing agencies, and remote content teams in Pakistan frequently encounter an infuriating barrier when uploading website files via FileZilla, Cyberduck, or WinSCP:

Status: Connecting to 194.168.10.45:21...
Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: Verifying certificate...
Status: TLS connection established.
Command: USER clientuser
Response: 331 User clientuser OK. Password required
Command: PASS **********
Response: 230 OK. Current restricted directory is /
Command: PASV
Response: 227 Entering Passive Mode (194,168,10,45,193,42)
Command: MLSD
Error: The data connection could not be established: ETIMEDOUT - Connection attempt timed out
Error: Failed to retrieve directory listing

The authentication phase succeeds instantly, but the moment FileZilla attempts to retrieve a directory listing or upload a theme file, the transfer hangs on the PASV (Passive) command and aborts with ETIMEDOUT.

This breakdown is caused by a clash between FTP Passive Mode architecture and the security perimeter of Pakistani telecommunications networks.

Pakistani broadband providers (PTCL, Nayatel, StormFiber, Wateen) route subscriber connections through restrictive consumer routers and Carrier-Grade NAT (CGNAT) gateways that block unnegotiated high-number TCP ports.

Concurrently, cPanel servers running ConfigServer Security & Firewall (CSF) block incoming high-port ranges by default unless explicitly configured.

In this sysadmin masterclass, we dissect how FTP Passive Mode operates, configure restricted passive port ranges in Pure-FTPd, align CSF firewall rules, enforce strict TLS 1.3 encryption, and resolve NAT IP mapping on Dedicated Servers in Pakistan.

---

1. Active vs. Passive FTP: Why Active Mode Fails Behind Pakistani CGNAT

To understand why passive configuration is non-negotiable, inspect how the two FTP modes handle data channels:

Active Mode (Blocked by Client-Side Firewalls):
Client (Port 1025) --- Connects to Port 21 (Control) ---> Server
Server (Port 20)   --- Initiates Data Connection! -------> Client (Port 1026)
[BLOCKED: Client's ISP router drops the incoming connection from the server!]

Passive Mode (The Modern Standard):
Client (Port 1025) --- Connects to Port 21 (Control) ---> Server
Client             --- Sends PASV command --------------> Server
Server             <-- Tells Client: "Connect to Port 50012" -- Client
Client             --- Initiates Data Channel to Port 50012 --> Server
[SUCCESS: But ONLY IF Server Firewall allows Port 50012 through!]

Under Passive Mode, the client establishes both the control channel (Port 21) and the data channel (arbitrary high port). If your server firewall has not opened the matching ephemeral port range, CSF immediately drops the client’s packet, resulting in ETIMEDOUT.

---

2. Step 1: Configuring Restricted Passive Port Ranges in WHM

By default, Pure-FTPd attempts to use any random unreserved high port between 1024 and 65535. We must restrict this to an explicitly managed range:

1. Log into WHM as root.
2. Navigate to Service Configuration -> FTP Server Configuration.
3. Locate Passive Port Range (or edit /var/cpanel/conf/pureftpd/main).
4. Set the range to:

   49152:65534

5. (Optional for Cloud / NAT VPS): If your server sits behind a 1:1 NAT private IP (such as an AWS EC2 instance or private datacenter VLAN), configure the public IP:

   ForcePassiveIP: 194.168.10.45

6. Click Save to restart Pure-FTPd.

# Verify the configuration file directly on the command line:
grep -i "PassivePortRange" /etc/pure-ftpd.conf

Expected output:

PassivePortRange          49152 65534

---

3. Step 2: Opening the Passive Range in CSF Firewall

Pure-FTPd cannot receive data connections if ConfigServer Security & Firewall (CSF) drops the incoming packets:

# Edit CSF configuration
sudo nano /etc/csf/csf.conf

Find the TCP_IN and TCP6_IN directives. Append 49152:65534 to the allowed incoming ports list:

# /etc/csf/csf.conf
# Add 49152:65534 to TCP_IN and TCP6_IN:
TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,49152:65534"

TCP6_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,49152:65534"

Restart CSF and LFD to apply the iptables rules immediately:

sudo csf -r

---

4. Step 3: Enforcing Strict TLS 1.3 & Disallowing Cleartext FTP

Allowing unencrypted FTP (Port 21 plaintext) exposes client cPanel usernames and passwords to sniffing across shared Wi-Fi networks in coffee shops and offices.

Configure Pure-FTPd to mandate FTPS (FTP over Explicit TLS):

1. In WHM -> FTP Server Configuration:
2. Set TLS Encryption Support to Required (Command/Data). (This maps to TLS 2 in /etc/pure-ftpd.conf, rejecting any client attempting plain unencrypted login).
3. Set TLSCipherSuiteHigh:

   ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305

4. Save and restart.

To ensure your web and mail servers follow the same enterprise security posture, review our guides on cPanel Imunify360 IP Reputation Tuning and cPanel Exim Retry Queue & Spool Tuning.

---

5. Verification & Client Configuration

Test the connection directly using FileZilla:

1. Open FileZilla -> Site Manager.
2. Protocol: Select FTP - File Transfer Protocol.
3. Encryption: Select Require explicit FTP over TLS.
4. Transfer Settings Tab:
   • Transfer Mode: Select Passive (recommended).

FileZilla Log Output (Healthy Handshake):
Status: TLS connection established.
Command: PASV
Response: 227 Entering Passive Mode (194,168,10,45,210,112)
Command: MLSD
Response: 150 Connecting to port 53872
Response: 226-Options: -a -l 
Response: 226 42 matches total
Status: Directory listing of "/" successful. (Transferred in 38ms)

For hosting agencies managing hundreds of customer uploads every hour, deploying on unthrottled Dedicated Servers eliminates hypervisor network queue throttling and guarantees multi-gigabit file transfer speeds across Pakistan.

---